diff mbox series

[5.4,07/53] sr9700: sanity check for packet length

Message ID	20220228172248.850170902@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Oliver Neukum <oneukum@suse.com>, Grant Grundler <grundler@chromium.org>, "David S. Miller" <davem@davemloft.net> Subject: [PATCH 5.4 07/53] sr9700: sanity check for packet length Date: Mon, 28 Feb 2022 18:24:05 +0100 Message-Id: <20220228172248.850170902@linuxfoundation.org> In-Reply-To: <20220228172248.232273337@linuxfoundation.org> References: <20220228172248.232273337@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.4,02/53] clk: jz4725b: fix mmc0 clock gating [5.4,06/53] drm/amdgpu: disable MMHUB PG for Picasso [5.4,07/53] sr9700: sanity check for packet length [5.4,08/53] USB: zaurus: support another broken Zaurus [5.4,10/53] x86/fpu: Correct pkru/xstate inconsistency [5.4,13/53] lan743x: fix deadlock in lan743x_phy_link_status_change() [5.4,15/53] perf data: Fix double free in perf_session__delete() [5.4,16/53] bpf: Do not try bpf_msg_push_data with len 0 [5.4,19/53] gso: do not skip outer ip header in case of ipip and net_failover [5.4,22/53] net/mlx5e: Fix wrong return value on ioctl EEPROM query failure [5.4,24/53] net: Force inlining of checksum functions in net/checksum.h [5.4,25/53] nfp: flower: Fix a potential leak in nfp_tunnel_add_shared_mac() [5.4,27/53] net/mlx5: Fix possible deadlock on rule deletion [5.4,30/53] configfs: fix a race in configfs_{,un}register_subsystem() [5.4,32/53] tracing: Have traceon and traceoff trigger honor the instance [5.4,33/53] iio: adc: men_z188_adc: Fix a resource leak in an error handling path [5.4,34/53] iio: adc: ad7124: fix mask used for setting AIN_BUFP & AIN_BUFM bits [5.4,35/53] iio: Fix error handling for PM [5.4,36/53] ata: pata_hpt37x: disable primary channel on HPT371 [5.4,40/53] tracefs: Set the group ownership in apply_options() not parse_options() [5.4,41/53] USB: serial: option: add support for DW5829e [5.4,43/53] usb: dwc3: pci: Fix Bay Trail phy GPIO mappings [5.4,44/53] usb: dwc3: gadget: Let the interrupt handler disable bottom halves. [5.4,46/53] xhci: Prevent futile URB re-submissions due to incorrect return value. [5.4,48/53] tty: n_gsm: fix proper link termination after failed open [5.4,49/53] tty: n_gsm: fix NULL pointer access due to DLCI release

Commit Message

Greg KH Feb. 28, 2022, 5:24 p.m. UTC

From: Oliver Neukum <oneukum@suse.com>

commit e9da0b56fe27206b49f39805f7dcda8a89379062 upstream.

A malicious device can leak heap data to user space
providing bogus frame lengths. Introduce a sanity check.

Signed-off-by: Oliver Neukum <oneukum@suse.com>
Reviewed-by: Grant Grundler <grundler@chromium.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/usb/sr9700.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff mbox series

Patch

--- a/drivers/net/usb/sr9700.c
+++ b/drivers/net/usb/sr9700.c
@@ -410,7 +410,7 @@  static int sr9700_rx_fixup(struct usbnet
 		/* ignore the CRC length */
 		len = (skb->data[1] | (skb->data[2] << 8)) - 4;
 
-		if (len > ETH_FRAME_LEN)
+		if (len > ETH_FRAME_LEN || len > skb->len)
 			return 0;
 
 		/* the last packet of current skb */